Read the docs
TI-2026-55194 Aliases CVE-2026-79698GHSA-jv2h-v536-h99j

Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection

Priority HIGH 76CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03152 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed WISE-6610-NB (Advantech): 1.2.4_20260821WISE-6610-EB (Advantech): 1.2.4_20260821+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdvantechWISE-6610-NB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-TB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-JB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-CB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-NB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-EB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-TB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-JB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-CB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610P-DEA1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610P-DNA1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610P-DTA1.2.1_202511101.2.4_20260821Patch availableCNA
  • WISE-6610-NB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-TB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-JB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-CB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-NB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-EB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-TB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-JB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-CB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610P-DEA VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610P-DNA VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610P-DTA VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA

CPE names CNA · 13

CPEVersionsRoleVendor
cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:*——Advantech
  • cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:* Versions — — ·Advantech
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:*——Advantech
  • cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:* Versions — — ·Advantech

Remediation

  • Fix · CNA WISE-6610-NB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-TB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-JB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-CB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-NB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-EB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-TB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-JB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-CB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610P-DEA (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610P-DNA (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610P-DTA (Advantech) Fixed in 1.2.4_20260821

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-79698
  2. 2026-10-03 Alias added: GHSA-jv2h-v536-h99j

References

Exploit 1

Patch 1

Other 2

  • TI-2022-01984 Command injection in Advantech iView CVSS 3.1CRITICAL 9.8
  • TI-2025-24399 Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass CVSS 4.0CRITICAL 10.0
  • TI-2023-05193 Advantech R-SeeNet Unauthenticated Read/Write CVSS 3.1CRITICAL 9.8
  • TI-2016-00768 Unrestricted file upload vulnerability in the uploadImageCommon function in the… CVSS 3.0CRITICAL 9.8
  • TI-2021-04850 OS command injection in Advantech CVSS 3.1CRITICAL 9.8
  • TI-2026-55193 Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection CVSS 4.0CRITICAL 9.4
See all 433 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences